01Location
- ~/Library/Safari/History.db
- ~/Library/Safari/History.db-wal
- ~/Library/Safari/History.plist (older Safari versions)
02Questions it answers
- Which URLs were visited in Safari and when?
- What page title was shown at the time of each visit?
- Did a visit redirect to or from another visit?
- Did the page load successfully?
03Format and versions
| Format | SQLite 3 database. visit_time is a REAL number of seconds relative to 2001-01-01 00:00:00 GMT (CFAbsoluteTime). |
|---|---|
| Applies to | Apple does not publish this schema; table and column names here are from the plaso Safari history parser and should be confirmed on the examined version. |
04Key fields
| Field | What it tells you |
|---|---|
| history_items (id, url, domain_expansion, visit_count, daily_visit_counts, weekly_visit_counts) | One row per URL with aggregate counts. |
| history_visits (id, history_item, visit_time, title, load_successful, http_non_get, synthesized, redirect_source, redirect_destination, origin) | One row per visit; history_item → history_items.id; redirect_* reference other visit ids. |
| history_tombstones (id, start_time, end_time, url, generation) | Present in the schema; Apple does not document its semantics, so verify its meaning on test data before relying on it. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| history_visits.visit_time | Mac absolute time: REAL seconds since 2001-01-01 00:00:00 UTC | Unix seconds = value + 978307200; fractional seconds are kept. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy History.db with its -wal file.
- Join history_visits.history_item to history_items.id and add 978307200 to visit_time for Unix time.
- Follow redirect_source and redirect_destination to group redirect chains into one navigation.
- Compare with other browsers' history and with macOS logs for the same period.
07Interpretation pitfalls
- The schema is undocumented by Apple and can change between Safari releases.
- History synced through iCloud from other devices can be present; do not assume every visit happened on this Mac.
- Mixing the 2001 epoch with the 1970 or 1601 epochs produces dates that are decades off.
09Sources
- plaso — parsers/sqlite_plugins/safari.py log2timeline/plaso (GitHub) · checked 2026-10-14
- ForensicArtifacts — artifacts/data/webbrowser.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14